User manual NOVELL XDASV2 ADMINISTRATION GUIDE V1

[. . . ] novdocx (en) 16 April 2010 AUTHORIZED DOCUMENTATION Administration Guide Novell® v1 October 15, 2010 XDASv2 for eDirectory, IDM, and NMAS www. novell. com Novell XDASv2 Administration Guide novdocx (en) 16 April 2010 Legal Notices Novell, Inc. , makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. , reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. Further, Novell, Inc. , makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. , reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to notify any person or entity of such changes. [. . . ] Consider the Modify account events whenever a request to change attribute information of a particular account is made. An account security token may be a password, or any other type of authentication materials associated with a user account. Here, a user account means any type of account by which a user, application, or system service may authenticate, and then act with the rights of that account. Enable Account 0. 0. 0. 3 Query Account 0. 0. 0. 4 DSE_SEARCH Query an existing account Modify Account 0. 0. 0. 5 DSE_MERGE_ Modify an existing ENTRIES account Modify Account Security Token 0. 0. 0. 6 DSE_CHGPAS Modify an existing S account security token Query Account Security Token Delete Account Security Token A. 2 Session Management Events A session is the association of an initiator with a stream of communication. A session may represent a user's connection to server, as in the case of logging into a Unix or Windows host, or a set of related transactions in a connection-less environment, as in the case of using a cookie to maintain persistent transactions between a browser client and a Web server. 22 Novell XDASv2 Administration Guide novdocx (en) 16 April 2010 Table A-2 Session Management Event Taxonomy Event Name Event Identifier Corres. eDir Event Description Use Create Session 0. 0. 1. 0 Create a new session Terminate an existing session This event should be reported whenever a new session (as defined above) is created. This event should be reported whenever an existing session (as defined above) is terminated. Terminate Session 0. 0. 1. 1 Query Session 0. 0. 1. 2 Query user session This event should be reported attributes whenever attribute information is requested on an existing session. DSE_CHANGE Modify user session This event should be reported whenever attribute information _CONN_STAT attributes E is modified on an existing session. Modify Session 0. 0. 1. 3 A. 3 Data Item and Resource Element Management Events This set of events relate to the creation and management of data items and resource elements within a domain. The type of data item or resource element is dependent upon the domain. For example, files and directories, device special files, and shared memory segments within an operating system, tables and records within a database, messages within an email system. The term data item is used in this context to refer to any type of resource element. Table A-3 Data Item and Resource Element Management Event Taxonomy Event Name Event Identifier Corresponding eDir Event Dexription Use Create Data Item 0. 0. 2. 0 DSE_CREATE Create a data item This event is reported whenever a _ENTRY security-relevant data item or resource element is created. DSE_DELETE Delete a data item This event is reported whenever a _ENTRY security-relevant data item or resource element is deleted DSE_COMPA RE_ATTR_VA LUE Query data item attributes This event is reported whenever a security-relevant data item or resource element is queried ­ either for value, or for an attribute of the data item. Delete Data Item 0. 0. 2. 1 Query Data Item Attribute 0. 0. 2. 2 XDASv2 Events 23 novdocx (en) 16 April 2010 Event Name Event Identifier Corresponding eDir Event Dexription Use Modify Data Item Attribute 0. 0. 2. 3 DSE_DEFINE _ATTR_DEF DSE_REMOV E_ATTR_DEF DSE_REMOV E_CLASS_DE F DSE_DEFINE _CLASS_DEF DSE_MODIFY _CLASS_DEF Modify data item attributes This event is reported whenever a security-relevant data item or resource element is modified ­ either the value, or an attribute of the data item A. 4 Service or Application Management Events This set of events relates to the management of services or applications. For example, the RPM package manager might throw these events as packages are installed or removed from a Linux system. Windows 32 Service Control Manager (SCM) events sent to the Windows 32 System Event Log may be translated into these events as they are imported into OpenXDASv2. This set of events could also be much more domain-specific, including concepts such as installing, removing, or configuring installable executable-modules within a single application domain. The key idea is to ensure that reported events have security significance. Table A-4 Service or Application Management Event Taxonomy Event Name Event Identifier Corresponding eDir Event Description Use Install Service 0. 0. 3. 0 DSE_CHANG E_MODULE_ STATE DSE_CHANG E_MODULE_ STATE Install a service or application Remove a service or application Query the configuration of a service or application Modify configuration of a service or application This event is reported when a service or application is installed This event is reported when a service or application is removed. This event is reported when service or application configuration information is requested. This event is reported when service or application configuration information is modified. This event is reported when a service, operation or function is disabled. Remove Service 0. 0. 3. 1 Query Service Configuration 0. 0. 3. 2 Modify Service Configuration 0. 0. 3. 3 Disable Service 0. 0. 3. 4 DSE_CLOSE_ Disable a service BINDERY or application 24 Novell XDASv2 Administration Guide novdocx (en) 16 April 2010 Event Name Event Identifier Corresponding eDir Event Description Use Enable Service 0. 0. 3. 5 DSE_OPEN_B Enable a service INDERY or application This event ise reported when a service, operation or function is enabled. A. 5 Service or Application Utilization Events This class of events relates to the use of services and applications. They typically map to the execution of a program or a procedure and manipulation of the processing environment. Table A-5 Service or Application Utilization Events Taxonomy Event Name Event Identifier Corresponding eDir Event Description Use Invoke Service 0. 0. 4. 0 DSE_START_ Invoke a service or This event is reported when a UPDATE_SCH application security-relevant service is EMA invoked. DSE_END_UP Terminate a service This event is reported when a DATE_SCHE or application service is terminated. MA Query a processing This event is reported when any context attributes of a process context are queried ­ this event is somewhat specific to operating systems, but some use can be found in other domain-specific applications. DSE_SERVE R_RENAME DSE_SYNTHE TIC_TIME DSE_SERVE R_ADDRESS_ CHANGE Modify processing context This event is reported when any attributes of a process context are modified ­ this event is somewhat specific to operating systems, but some use can be found in other domain-specific applications. Terminate Service 0. 0. 4. 1 Query Process Context 0. 0. 4. 2 Modify Process Context 0. 0. 4. 3 A. 6 Peer Association Management Events Peer association events are related to the association of a user or identity with a group, or the association of two users in some domain-specific context. [. . . ] The Data object is a set of name/value pairs describing class-specific attributes of the actor. The schema does not define the actual fields, as different classes will have a unique set of data attributes (if any). The observer of an event is the authenticated identity of an entity (service) that is monitoring the system, and generating events based on initiator actions. An observer is described in terms of an account and an entity (described below). [. . . ]